Threat video1:00
Suspected TraderTraitor Bitget Heist: Detection & IOCs
Forged withdrawals drained Bitget hot wallets after a backend breach, with no keys stolen. 9 detection rules, 13 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Suspected TraderTraitor Bitget Heist: Detection & IOCs →
Chapters
- 0:00The hookAbout $387M lost from Bitget wallets.
- 0:05The storyIts own signer signed forged withdrawals.
- 0:11Attack pathZero-day in a security product.
- 0:24AttributionAttributed to North Korean state-linked actors.
- 0:30Indicators of compromise5 indicators to hunt: 1 hash, 1 smart contract and 3 wallet addresss.
- 0:37MITRE ATT&CK techniques9 ATT&CK techniques, from initial access to impact.
- 0:42Remediation4 steps now: Have the signer verify risk decisions independently.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About $387M lost from Bitget wallets.
0:05Its own signer signed forged withdrawals.
0:08No private keys stolen.
0:12Zero-day in a security product.
0:14Then it read a database password.
0:16Web shell, then malicious packages.
0:19Forged risk fields, then drained.
0:25Attributed to North Korean state-linked actors. Confidence: medium.
0:315 indicators to hunt: 1 hash, 1 smart contract and 3 wallet addresss.
0:389 ATT&CK techniques, from initial access to impact.
0:434 steps now: Have the signer verify risk decisions independently.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.